Privacy Policy

1. Who Is Responsible for Your Data

The data controller for the purposes of the Data Protection Act 2017 is Robin Chinneya, trading as West Coast Dream, based in Flic en Flac, Rivière Noire, Mauritius. As controller, we determine why and how your personal data is processed in connection with this website and villa bookings.

2. Information We Collect

We only collect what is necessary to respond to enquiries and manage bookings:

Contact form / enquiries

• Full name
• Email address
• Phone number (optional)
• The content of your message

WhatsApp enquiries

• Your name and phone number, as provided by WhatsApp when you message us

Direct bookings made and paid for on this website

• Full name, email address, and phone number (optional)
• Check-in and check-out dates
• Number of guests
• Any special requests you enter
• A system-generated booking reference and the amount paid

Automatically collected data

If you accept our cookie banner, we collect limited technical information (pages viewed, approximate location, device/browser type) via Google Analytics, described further in Section 6.

3. Our Legal Basis for Processing

Under the Data Protection Act 2017, we only process your personal data where we can rely on one of the following lawful bases:

• Consent — for example, when you accept analytics cookies, or contact us voluntarily.
• Performance of a contract — processing your name, contact details, dates, and payment information is necessary to create and honour your booking.
• Legitimate interest — for example, keeping booking records to prevent double-bookings and to respond to guest enquiries efficiently, balanced against your right to privacy.
• Legal obligation — for example, retaining certain financial records for accounting and tax purposes as required by Mauritian law.

4. How We Use Your Information

• To respond to enquiries about availability, pricing, and the villa
• To create, confirm, and manage a direct booking, including sending confirmation emails, invoices, and receipts
• To communicate essential details about your upcoming or current stay (check-in instructions, house rules, etc.)
• To maintain accurate calendar availability, including syncing confirmed direct bookings so the same dates cannot be double-sold via Airbnb
• To keep basic accounting and booking records as required by law

We do not use your personal data for marketing or send promotional messages without your explicit consent.

5. Payment Processing (PayPal)

Direct bookings paid for on this website are processed entirely through PayPal, using PayPal's own hosted checkout (PayPal Buttons / Advanced Card Payments). This means:

• Your card or PayPal account details are entered directly into PayPal's interface, not ours.
• Our servers never see, transmit, or store your full card number, expiry date, or CVV — this keeps us out of the scope of handling raw cardholder data (a PCI-DSS best practice).
• PayPal shares with us only what is required to confirm your booking: payment status, the amount charged, and a transaction/order reference.
• PayPal separately issues its own transaction receipt and, where applicable, an invoice — both governed by PayPal's own privacy practices.

See PayPal's own Privacy Policy for details of how PayPal (a company incorporated outside Mauritius) processes your payment data.

6. Cookies & Analytics

We use a cookie consent banner in line with good practice under the Data Protection Act 2017's transparency and consent principles. Analytics cookies are only set if you click "Accept". If you click "Decline", or simply close the banner without responding, no analytics or tracking cookies are set on your device.

Where enabled, we use Google Analytics to understand general usage patterns (which pages are viewed, approximate location at a country/region level, device and browser type). This information is aggregated and is not used to identify you personally. You can withdraw your consent at any time by clearing your browser's cookies/site data for this domain, or by declining when the banner reappears. See Google's Privacy Policy for how Google handles this data.

7. Sharing & Third-Party Processors

We do not sell, rent, or trade your personal data. To operate the website and manage bookings, limited data is shared with the following service providers, each acting as a data processor on our behalf:

These providers are contractually and/or by their own published terms restricted from using your data for their own independent marketing purposes. We may also disclose personal data where required to do so by Mauritian law, regulation, court order, or a lawful request from a competent authority.

8. Cross-Border Data Transfers

Some of the service providers listed above (PayPal, EmailJS, Netlify, Google) store or process data on servers located outside the Republic of Mauritius. The Data Protection Act 2017 restricts the transfer of personal data outside Mauritius unless the recipient country ensures an adequate level of protection, or another safeguard applies (such as your consent, or the transfer being necessary for the performance of a contract with you — e.g. processing your payment).

By making a booking or enquiry through this website, you acknowledge that your data may be transferred to, and processed in, countries outside Mauritius by the providers named above, each of which maintains its own security and compliance standards (including, where applicable, compliance with the EU General Data Protection Regulation).

9. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in line with the security obligations set out in the Data Protection Act 2017. This includes:

• Using encrypted connections (HTTPS/TLS) across the entire website
• Never handling or storing raw card data ourselves — this is fully delegated to PayPal
• Restricting access to stored booking records to the site owners only
• Relying on reputable, security-conscious infrastructure providers (Netlify, PayPal)

No method of transmission or storage is 100% secure, but we work to keep your data as safe as reasonably possible.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, namely:

• Enquiry details — kept only as long as needed to respond, unless a booking follows.
• Confirmed booking records — retained for the duration of the stay plus a reasonable period afterward to handle any post-stay issues, disputes, or refund requests, and as required to satisfy accounting and tax obligations under Mauritian law.
• Where you exercise your right to erasure (see Section 11), we will delete or anonymise your data unless we are legally required to retain it (for example, financial records).

11. Your Rights Under the Data Protection Act 2017

As a data subject under Mauritian law, you have the following rights in relation to your personal data:

To exercise any of these rights, contact us using the details in Section 16. We will respond within the timeframes required by the Data Protection Act 2017.

12. Children's Privacy

This website and our booking services are not directed at children. We do not knowingly collect personal data from minors. Bookings and payments must be made by an adult, who is responsible for any guests, including minors, included in the stay.

13. Bookings Made Through Airbnb

If you book West Coast Dream through Airbnb rather than directly on this website, your personal data is collected and processed by Airbnb under Airbnb's own Privacy Policy, not this one. We only receive the booking and guest details Airbnb provides to hosts in order to prepare for and manage your stay.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we use, or applicable law. The "Last updated" date at the top of this page will always reflect the most recent revision. We encourage you to review this page periodically.

15. Governing Law & Complaints

This Privacy Policy, and any dispute relating to the processing of your personal data by us, is governed by the laws of the Republic of Mauritius, including the Data Protection Act 2017 and its subsidiary regulations.

If you believe we have not handled your personal data in accordance with this policy or the law, you have the right to lodge a complaint with:

We would, however, appreciate the opportunity to address your concern directly first — see Section 16.